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A method and device for monitoring signal processing units for sensors 

The invention relates to a method and a device for monitoring signal processing units 
for sensors which detect the individual process control quantities or process measured 
values of a process. 

Electronic stability programs are driving dynamics control systems for vehicles that 
serve to support the driver in critical driving situations during braking, accelerating and 
steering, and to intervene in cases where the driver himself has no possibility of inter- 
vening directly. The control system supports the driver during braking, particularly on a 
roadway with a low or changing friction value, on which the vehicle can no longer be 
controlled because of locking wheels, or could begin skidding upon accelerating, 
whereby there is a danger of the drive wheels spinning, as well as, finally, during steer- 
ing on a curve during which the vehicle could oversteer or understeer. On the whole, 
not only the comfort, but also the active safety, is thereby significantly improved. The 
basis for such a control system is formed by a closed control circuit which, during the 
normal operation of the vehicle, assumes typical control tasks and, during extreme driv- 
ing situations, is intended to catch the vehicle as quickly as possible. Sensors for the 
determination of the different driving dynamics parameters are, as the actual value 
transmitters, thereby particularly important. A plausible control presupposes that the 
sensors correctly reproduce the actual condition of the control system interval. This is 
particularly important during driving stability control actions in extreme driving situations, 
in which a deviation from control must be fully stabilized within a very short time. For 
this reason, the sensors in an electronic stability program (yaw rate sensor, lateral ac- 
celeration sensor, and steering angle sensor) must be monitored continuously. A corre- 
sponding online-sensor monitoring has the purpose of detecting errors in the sensors at 
an early stage, so that an error in control that could bring the vehicle into a safety- 
critical condition is ruled out. 

The ESP systems that are in serial production at the present time use a multiple sensor 
("sensor cluster") for the determination of the rotational rate of the vehicle, as well as of 
the lateral and the longitudinal acceleration, if necessary. This sensor is placed in the 
passenger space and communicates with the ESP control device by way of a CAN in- 
terface (WO 99/47889). 

Future applications (such as the ESP 2 or active front steering AFS, for example) even 
use the signals of the sensor cluster to influence the steering. Since steering interven- 
tions entail significantly higher risks than braking interventions, greater demands are 
also placed on the reliability of the sensing technology. Redundant systems, which can 
recognize error functions independently and react correspondingly, are required. 



Figure 1 depicts a known sensor cluster in a redundant design. The rotation rate sensor 
(11, 12) and the acceleration sensor (1, 2) are thus present twice. The signal process- 
ing is carried out in a commonly used set of chips. The A/D transformers (ADC 1 and 
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ADC 2) and the processor core (//C1 , /jC2) are thereby designed redundantly, while the 
signal paths (13, 14) (such as the SPI interface between the transformers and proces- 
sors, reception register, etc., for example) are only present once, however. Defective 
sensor elements, as well as errors in the program design, can thus be detected. 

It is disadvantageous, however, that errors are not detected on the transmission path 
between the A/D transformer (ADC) and the processor, just as errors in the A/D trans- 
former itself (such as partial bits, for example), which lie within the order of magnitude 
of the permissible signaling precision, are also not detected. 

The task that forms the basis for the invention is thus that of creating a method and a 
device for monitoring the signal processing of sensors of the type stated above that has 
the reliability that is necessary, particularly for driving stability control and/or comfort 
control during active steering interventions for vehicles. 

This task is solved, in accordance with claim 1, by means of a method of the type 
stated above, which is characterized by an at least redundant processing of the sensor 
data in two identical signal processing units, which are each evaluated and checked for 
plausibility, independently and separately from one another, by means of at least two 
processing devices in two evaluation devices, whereby the sensor data are transmitted 
between the one processing device and the one evaluation device through separate 
signal lines. 

It is advantageous that, in every evaluation device sensor, the data that are separately 
evaluated and checked for plausibility are exchanged by way of an interface between 
the evaluation devices. The sensor data and the condition information of the specific 
other evaluation unit that have been evaluated and checked for plausibility are thereby 
sent to a superordinate control device of the vehicle by each evaluation device, inde- 
pendently of the other one. 

The transmission of the sensor data and the condition information that have been 
evaluated and checked for plausibility to the other evaluation unit is carried out, by way 
of internally separate signal lines, to one data bus and the control device of the vehicle. 

This task is additionally solved, in accordance with claim 5, with a device of the type 
stated above, which is characterized by at least two identical signal processing units for 
the redundant processing of the sensor data, with at least two processing devices and 
two evaluation devices, in which the sensor data are evaluated and checked for plausi- 
bility independently of and separately from one another, whereby one processing de- 
vice is connected with the one evaluation device by way of separate signal lines, and 
the sensor data are transmitted between the one processing device and the one 
evaluation device by way of the separate signal line. 

Advantageous further developments of the invention are stated in the sub-claims. 
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The following advantages result from the invention: 

• Completely redundant signal path all the way to the signal output. All errors ap- 
pearing in the system can be detected. 

• Prevention of a loss of comfort from a premature system activation caused by 
errors that are still within the framework of the range specified. 

• Suitability for highly sensitive systems with very low control thresholds. 

• Cost savings through the use of components identical to the non-redundant 
standard sensor cluster. No special components (such as double core proces- 
sors, for example) are necessary. 

Examples of implementation of the invention are depicted in the diagrams, and are de- 
scribed in further detail in the following. 

These depict the following: 

Figure 1 : A simple redundant sensor cluster in accordance with the state of the art; 

Figure 2: A schematic representation of the structure of an ESP system; 

Figure 3: A completely redundant sensor cluster in accordance with the invention. 

The process of auto driving can be considered, in accordance with Figure 2, in a tech- 
nical control sense, as a control circuit in which a driver (1) represents the control unit, 
and a vehicle (2) represents the control system. The control inputs are thereby the per- 
sonal driving wish (FW) of the driver, which he determines through the continuous ob- 
servation of the road traffic. The actual values (IF) are the current values for the direc- 
tion and speed of travel, which the driver determines by means of his sight or driving 
sensations, as the case may be. The control variables (SF) are, finally, the steering 
wheel angle, the position of the transmission, as well as the positions of the gas and 
brake pedals, which are determined by the driver on the basis of the deviations be- 
tween the theoretical and the actual values. 

Such a type of control is frequently made more difficult by disturbances (S), such as 
changes in friction values, irregularities in the roadway, lateral wind, or other influences, 
since the driver cannot precisely detect these, but still must take them into considera- 
tion during the control, however. For this reason, the driver (1) can, to be sure, generally 
manage the tasks conveyed to him - that is to say, controlling and observing the proc- 
ess of driving the auto under normal driving conditions - on the basis of his training and 
accumulated experience without difficulties. Under extreme situations and/or under the 
extraordinary driving conditions noted, under which the physical friction boundaries be- 
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tween the roadway and the tires are exceeded, the danger does exist, however, that the 
driver will react too late, or incorrectly, and will lose control of his vehicle. 

In order to be able to take even these driving situations into account, the driving dynam- 
ics control system is supplemented by a subordinate control circuit (ESP) which, in ac- 
cordance with Figure 1, comprises a control algorithm (4), a system monitoring unit (5), 
and an error memory (6). Measured driving condition values are thereby transmitted to 
the system monitoring unit (5) and to the control algorithm (4). The system monitoring 
unit (5) produces an error message (F), if necessary, which is transmitted to the error 
memory (6) and to the control algorithm (4). The control algorithm (4) then acts on the 
vehicle (2) in dependence on the control variables produced by the driver (1). Typical 
control tasks are carried out with this control circuit. Under extreme driving situations, 
the vehicle can be caught again as quickly as possible. 

Figure 3 depicts the structure of such a control circuit, which essentially comprises an 
anti-blocking system (10), a drive skidding control (11), and a yaw momentum control 

(12) . The system can be supplemented by a steering angle control not depicted in fur- 
ther detail, such as is described in WO 2004/005093, for example. In addition, yaw rate 
sensors (13), lateral acceleration sensors (14), a steering angle sensor (15), a pressure 
sensor (16), and four wheel speed sensors (17) are provided, which are used both as 
actual value transmitters for the determination of the control deviation, as well as for the 
formation of a yaw rate theoretical value and various intermediate values. 

The process control inputs produced by the driver (1) through the activation of the gas 
and brake pedal, as well as the steering wheel, are added to the drive skidding control 
(11), the anti-blocking system (10), and the pressure sensor (16), as well as the steer- 
ing angle sensor (15), as the case may be. Vehicle-specific non-linearities, fluctuations 
of the friction values, lateral wind influences, etc., are summarized as disturbances or 
unknown values (18) and influence the longitudinal and lateral dynamics of the vehicle 
(19). This dynamic (19) is, furthermore, influenced by the control inputs noted, as well 
as by the output signals of an engine management unit (20), and acts on the wheel 
speed sensors (17), the yaw rate sensors (13), the lateral acceleration sensors (14), as 
well as the pressure sensor (16). A control arbitration unit (21), to which the output sig- 
nals of the anti-blocking system (10), the drive skidding control (11), the yaw momen- 
tum control (12), the steering angle control, and a braking intervention algorithm (22) 
are transmitted, serves for the distribution of priorities to these signals in relation to their 
effect on the engine management unit (20), or directly on the driving dynamics (19). 
The braking intervention algorithm (22) is thereby influenced by the yaw momentum 
control (12) and the pressure sensor (16). Finally, a driving condition detection unit (23) 
is provided, to which the signals of the steering angle sensor (15), the yaw rate sensors 

(13) , the lateral acceleration sensors (14), as well as the wheel speed sensors (17) are 
transmitted, and the output signals of which influence the yaw momentum control (12) 
as well as a single-track reference model (24), by means of which a theoretical yaw rate 
desired or the steering angle is produced. 
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The sensor cluster (40), with a completely symmetrical redundancy of the signal proc- 
essing units (43, 31, 46 and 44, 32, 45), is depicted in Figure 4. The sensor cluster (40) 
consists of two identical separate paths for the signal processing. The rotation rate sen- 
sor (41, 42) and the acceleration sensor (21, 22) are present twice. The sensors (41, 
42, 21, 22) and the signal processing units (43, 31, 46 and 44, 32, 45) are preferably 
positioned in a common casing (62). Two signal processing devices (43, 44), such as 
an analogue-digital signal transformer, which convert the analogue output signal of the 
sensors into a digital input signal, are assigned to them. Two evaluation devices (31, 
32), such as identical microcontrollers, digital signal processors (DSP), or programma- 
ble logic modules, particularly ASIC's, are used for the signal processing. The sensor 
data are transmitted between the one processing device (43, 44) and the one evalua- 
tion device (31, 32) by way of a separate signal line (60, 61). The signals, which are 
now present in digital form, are processed in the evaluation devices (31, 32) in digital 
form. The evaluation-related sensor signals are applied to the output side of the evalua- 
tion devices (31, 32). These are supplied to the serial vehicle communication bus (47) 
by way of the two CAN controllers (45, 46) provided in the evaluating devices (31, 32). 
The evaluation devices (31, 32), which are connected with the integrated CAN (control- 
ler area network) by way of the separate lines (71, 72), thereby assume the following 
system functions: 

• Preparation of a driver signal / driver voltage for the activation of the electrical- 
mechanical transformer of the rotation rate sensor (41 , 42). 

• Reception of the signals of the rotation rate sensor (41, 42) with specific algo- 
rithmic allocations and filtering in order to obtain a numerical value for the yaw 
movement of a vehicle. 

• Conversion of the numerical values of the yaw movement of a vehicle into the 
CAN and transfer to the serial bus (47). 

These evaluation devices (31, 32) can correspond precisely to the components used in 
the known sensor cluster (such as EP 1 064 520 B1, for example) - that is to say, no 
special components are then needed for this system. 

The outputs of both of the signal processing units (43, 31 , 46; 44, 32, 45) can be joined 
in the sensor cluster (40), or else they can be connected, in separate lines (49, 50), with 
the vehicle communication bus (here: CAN). In the event of a joining in the sensor clus- 
ter, the interface remains compatible with the existing system. 

Each of the evaluation devices (31 , 32) has access to all of the sensor data, and carries 
out a signal processing and plausibility evaluation independently of the others. It reports 
the result of its plausibility evaluation and of its computations, if applicable, to its partner 
by way of an appropriate interface (48). 
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Each of the evaluation devices (31, 32) thereupon sends a communication (here: CAN 
message) to the (ESP) control device independently of the others. This communication 
contains, in coded form, the specific data, the status of its own plausibility evaluation, 
as well as the condition signaled by the partner. 

The control device decides, in dependence on the status flags contained in the com- 
munications, whether the data are to be evaluated as valid, as conditionally valid, or as 
incorrect. Conditionally valid data can be evaluated through comparison with other val- 
ues, such as with the wheel speeds, for example, by means of the model: 




- and are additionally used, if necessary. (S) is hereby the lane width of the vehicle, 
(v vr ) is the wheel speed, front right, and (v v i) is the wheel speed, front left. Thus, in the 
event of a failure of a yaw rate signal, such as during an ESP control of the control de- 
vice, for example, the intact signal can be identified and used to continue the control by 
means of the available model data. 

In terms of expense, this solution corresponds to two separate identical sensor clusters. 
It has the advantage, however, that each cluster can have access to the sensing tech- 
nology of the other one. Additional information is made available by this means. 

The redundancy concept illustrated here in the example of a sensor cluster can be ap- 
plied to any other sensor systems desired. Thus, the following variations, which are 
jointly included in the invention, are conceivable: 

• The use of n >2 signal processing units (43, 31, 46), which access the signals of 
any desired number of sensors (41, 42, 21, 22), a portion of which may be re- 
dundantly present, but which do not have to be, however. 

• Redundant sensors (41 , 42) may be present in double form or in multiple form (> 
2). With three or more sensors, a decision can be made as to which sensor is 
defective, even during the signal processing. 

• The sensors (41, 42, 21, 22) and the signal processing units (43, 31, 46; 44, 32, 
45) do not have to be located in the same casing (62). 

• The connection (63-70) of the sensors to the signal processing units may be car- 
ried out by analogue or digital means. 



• The connection of the signal processing units (43, 31, 46; 44, 32, 45) to the su- 
perordinate control device may be carried out by analogue or digital means. 



c 
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• The signal processing units (43, 31, 46; 44, 32, 45) exchange status information, 
computation results, or even no information at all. 

• The signal processing units (43, 31, 46; 44, 32, 45) can carry out different tasks 
at different times (such as during the initialization phase or during self-diagnosis, 
for example). 

• Not every signal processing unit (43, 31 , 46; 44, 32, 45) has to evaluate all sen- 
sor signals, but even partially redundant systems are possible. 

In the event that a superordinate system is not acceptable, there is the advantageous 
form of implementation of only allowing one signal processing unit (43, 31, 46; 44, 32, 
45) to communicate actively. The other one(s) initially remain(s) passively in the back- 
ground, but nevertheless carry out the checking for plausibility with the corresponding 
internal communication, however. It is only if a discrepancy has been determined there 
that the passive signal processing units carry out a veto and actively report to the su- 
perordinate system. If realized in practical terms, this could appear as follows: 

The signal processing units (43, 31 , 46) and (44, 32, 45) are identical, but have a 
software coded by means of a PIN number, however, which makes two types of 
operation possible. 

The signal processing unit (43, 31, 46) works as a master (coding 1) and sends 
the result of its evaluation to the CAN. 

[The] signal processing unit (44, 32, 45) works as a slave (coding 0) and com- 
pares the result of the master received through the CAN with its own computa- 
tions. It reports an agreement or a deviation, as the case may be, to the master, 
and sends a CAN message to the system with an error flag set, if necessary. 

The communication can take place by way of two lines, MATCH, MATCH_N, for 
example, which toggle in an opposite manner in every software loop and, in the 
event of errors, either both go to 1 or both go to 0. 

The signal processing unit (43, 31, 46) recognizes, through the acknowledge- 
ment noted above, that the signal processing unit (44, 32, 45) is available and is 
working. 

The signal processing unit (44, 32, 45) recognizes, through the receipt of the 
CAN messages, that the signal processing unit (43, 31, 46) is available and is 
working. 



